Can I access someone else’s medical records (health records)?

Health records are confidential so you can only access someone else’s records if you’re authorised to do so.

To access someone else’s health records, you must:

  • be acting on their behalf with their consent, or
  • have legal authority to make decisions on their behalf (power of attorney), or
  • have another legal basis for access

Lasting Power of Attorney

A Lasting Power of Attorney (LPA) is a legal document that allows a person to appoint someone else to make decisions on their behalf. The person appointed is called an attorney.

There are two types of LPA relating to:

  • health and welfare
  • property and financial affairs

An attorney appointed on a health and welfare LPA can only make decisions when:

  • the person lacks the mental capacity to make decisions
  • the LPA document has been registered with the Office of the Public Guardian

Read more information about power of attorney, including applying for, registering and cancelling power of attorney.

Applying for access to someone else’s health records

Depending on which health records you want to see, submit your request in writing or by email to:

  • the person’s GP surgery
  • the person’s optician
  • the person’s dentist
  • the health records manager at the hospital trust where the person was treated
  • any other body that holds personal information

If you are applying for records on behalf of another individual in exercise of their rights, this is known as a Subject Access Request (SAR).

If possible, send a copy of the person’s written permission with your request. In cases where it is not possible to obtain written consent, other arrangements may need to be made to confirm that the patient has given consent.

The health records manager, GP or other healthcare professional will decide whether the request can be approved. They can refuse to supply some of your request if, for example:

  • it is likely to cause serious physical or mental harm to the patient or another person
  • the information you have asked for contains information that relates to another person.

Under the Data Protection Act, requests for access to records should be met within 40 days. However, government guidance for healthcare organisations says they should aim to respond within 21 days. 

Where patients are unable to give consent

If a patient is unconscious or unable to give consent or communicate a decision about their health records due to a mental or physical condition, their health professionals must take decisions about the use of information.

These decisions need to take into account the patient’s best interests and any previous wishes or decisions they may have expressed. The views of relatives or carers as to the likely wishes of the patient should also be taken into account.

If a patient is unable to consent, information should only be given that is in the patient’s best interests, and then only as much as is needed to support their care.

Fees to access someone else’s health records

You may have to pay a fee to access someone else’s health records, so ask if there is a charge before you apply to see them.

For more information, see What are the fees for accessing medical records (health records)?

Read the answers to more questions about NHS services and treatments.

Further information:

Page last reviewed: 06/08/2014

Next review due: 05/08/2016